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10.1 INTRODUCTION 

The disposal of large volumes of industrial and municipal wastes has been a source of 
ongoing concern throughout the latter half of the twentieth century. Over the past 20 years, 
increasingly stringent waste-disposal regulations have improved environmental quality 
while limiting disposal options and raising costs. Because waste reduction techniques are 
equally subject to the law of diminishing returns, some waste will always result from human 
activities, and disposal issues will remain to be addressed. From a societal viewpoint, the 
ideal disposal method should be (virtually) infinite, cheap, permanent, and result in no 
human or ecological exposures in the foreseeable future. Most current regulated methods of 
disposal, for example, landfills or incineration, fail in one or more of these areas. Only deep- 
well injection appears to satisfy all four requirements; however, the environmental risks 
associated with Class IH disposal technology remains a source of controversy. 

Approximately 150 underground injection wells exist in the United States that are cate- 
gorized by the United States Environmental Protection Agency (EPA) as Class IH (U.S. 
Environmental Protection Agency, 1996) wells that inject hazardous liquid waste. The 
majority of Class IH wells are located in the Great Lakes Region and the Gulf States, due 
to the favorable geology in these regions. Over half of these wells are located in Texas and 
Louisiana, and almost 90% are in EPA Regions V and VI (U.S. Environmental Protection 
Agency, 1996). Based on figures from the EPA's TRI (U.S. Environmental Protection 
Agency, 1996), the volume of hazardous waste disposed of through Class IH deep-well 
injection is about 220 million pounds. This quantity is somewhat deceptive, since the prac- 
tice of deep- well injection involves dilution of the waste with large amounts of water before 
it is pumped into the subsurface. Industries that practice deep- well injection are sometimes 
singled out as major sources of pollutant releases to the environment. Since the intent of 
deep- well injection is the permanent isolation of waste from the biosphere, it is unclear if 
the use of deep- well injection can be properly considered a release to the environment. 
While problems resulting from deep- well injection have occurred, these incidents took place 
in the past, and the conditions that caused them do not occur under current regulations and 
practices. 

In 1980, the EPA promulgated regulations governing all injection wells, including those 
injecting hazardous waste (53 FR 28131). In 1988, EPA passed additional regulations 
requiring operators of Class IH wells to demonstrate that no migration of the waste 
constituents will occur from the injection zone while the waste remains hazardous (or 
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for 10,000 years) (40 CFR Parts 146 and 148). Waste isolation is accomplished by a 
combination of: 

• The application of strict siting criteria. 

• The presence of multiple redundant engineered and geological barriers. 

• Practices to ensure chemical compatibility of waste with geology. 

• Operating restrictions and preventive maintenance during active injection operations. 

• Continual monitoring and testing of performance and confinement integrity. 

• The presence of alarms and a full-time operator. 

These factors combine to assure that waste will be prevented from entering the accessi- 
ble environment, i.e., that portion of the environment where human or ecological exposure 
can occur. In the absence of such exposure, no risk to human health or welfare exists. 

Studies published by both industry and the EPA in the past 10 years have concluded that 
the current practice of deep- well injection is both safe and effective, and poses an acceptably 
low risk to the environment (CH2M Hill, 1986a; Clark, 1994; Department of Energy and 
Natural Resources et al., 1989; Underground Injection Practices Council, 1987; U.S. 
Environmental Protection Agency, 1985, 1989, 1991; Ward et al., 1987). Nonetheless, vari- 
ous advocacy groups have challenged the effectiveness of deep- well-injection regulations, 
and have opposed the practice on principle (Gordon and Bloom, 1985; MacLean and 
Puchalsky, 1994; Sierra Club Legal Defense Fund, 1989). Studies purporting to examine the 
risks from deep-well injection take as their starting point the assumption that release of waste 
from confinement to a drinking water aquifer has already occurred and then model the trans- 
port time to a receptor well and the dose received by that receptor (The Cadmus Group, Inc., 
1995). None of these studies to date has assessed the probability of the release even occur- 
ring in the first place. Since the primary risk associated with deep-well injection is that iso- 
lation from the accessible environment might fail, this probability must be examined before 
drawing any conclusions regarding health or environmental risks from such a release. 

The purpose of this paper is to examine the risk from such a failure of isolation, and to 
provide an objective and quantitative analysis of the risk of waste isolation loss from Class 
IH underground injection wells that will allow meaningful identification and comparison of 
waste isolation subsystems as contributors to that risk. Areas of uncertainty will be identi- 
fied and quantified as to their possible contribution and importance to the risk estimates for 
the purposes of collecting additional data, identifying new sources of data, or stimulating 
new research to reduce these uncertainties. In doing so, we hope to provide all stakeholders 
with the type of rigorous scientific support needed to make appropriate decisions regarding 
deep- well injection. 

10.2 BACKGROUND 

A review of available studies on Class I injection well failures over the past 20 years was 
conducted. These studies originated from a variety of sources, including industry studies, 
peer-reviewed studies, trade association reports, as well as reports from advocacy groups. 
Case studies and accident reports involving injection wells were reviewed as well. The rel- 
evant regulations were also carefully reviewed to determine the ways that regulatory 
requirements and restrictions affect siting, design, construction, and operations. Numerous 
discussions and interviews were held with injection well operators and regulators. Based on 
this information, the critical factors to maintaining waste isolation were identified. 
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An important concept that appears throughout injection well risk studies and regulations 
is that of USDW. Releases from injection wells into the accessible environment (i.e., that 
portion of the environment where human or ecological exposures can occur) may occur 
either at the ground surface, or at subsurface groundwater zones that have potential human 
use. These subsurface groundwater zones are typically called USDWs in studies and regu- 
lations. While surface releases are readily observed and remedied, and as such do not result 
in chronic exposures and have not been included in risk assessments, potential releases to 
USDWs are the primary focus of risk assessments and regulations. Accordingly, this assess- 
ment assumes the relevant release point to be the lowermost USDW (i.e., closest to the 
injection zone). 

In general, previous studies fall into four categories. The first category is case studies of 
injection- well failures that have resulted in releases (CH2M Hill, 1986b; Clark, 1987; 
Engineering Enterprises, Inc. et al., 1986; Ken E. Davis Associates, 1986; Paque, 1986; 
Underground Resource Management, Inc., 1984). There are relatively few cases of this sort 
and none involving a release from a Class I well to a USDW since the EPA regulations took 
effect in 1980 (U.S. Environmental Protection Agency, 1985, 1991). These historical inci- 
dents are confined without exception to issues of well siting, design, and operation practices 
that are no longer allowed under today's regulations, nor do they exist in today's population 
of Class I wells (Clark, 1994; Engineering Enterprises Inc. et al., 1986; Ken E. Davis 
Associates, 1986; Paque, 1986; Underground Resource Management, Inc., 1984; U.S. 
Environmental Protection Agency, 1991). 

The second category is geologic fate and transport modeling studies (Buss et al., 1984; 
Davis, 1987; Don L. Warner, Inc. and Engineering Enterprises, Inc., 1984; Goolsby, 1972; 
Meritt, 1984; Miller et al., 1986; Morganwalp and Smith, 1988; Scrivner et al., 1986; U.S. 
Environmental Protection Agency, 1990a, 1990b; Ward et al., 1987). These studies assume 
a release from an injection well, and model the fate and transport of contaminants as they 
migrate through the typical geologic formations associated with injection wells. These 
include modeling efforts performed for the "no-migration petition" required for an operat- 
ing permit. In general, such studies demonstrate that the proper selection of the geologic for- 
mation creates an effective means to achieve waste isolation. While such studies can provide 
useful information on geologic factors important for maintaining waste isolation, and on the 
potential for failure of geologic barriers, they assume that a release has already occurred and 
do not account for waste isolation provided by engineered barriers of the well system. These 
studies can help with understanding mechanisms and the likelihood of failure of geologic 
formation as one component of the loss of waste isolation, and can help in developing esti- 
mates of release volumes and concentrations to USDWs. 

The third category is properly characterized as exposure studies (The Cadmus Group, 
Inc., 1995). One study of this type was found. In this study, it was assumed that a release 
occurred from the injection well to the USDW. The transport of this release into the USDW 
aquifer was modeled to a point of withdrawal for potable use. As with other modeling stud- 
ies, a release was assumed without providing any information on how the release occurred 
and the probability of that release mechanism. Additionally, such studies do not take into 
account the effect of the containment or attenuation factors posed by geologic features (e.g., 
layers of low-permeability rock) between the point of release and the USDW. 

The final category is regulatory reviews and comparative risk studies. A 1989 EPA com- 
parative risk evaluation of waste management alternatives by experts in the field concluded 
that deep- well injection posed among the lowest environmental risks on a relative scale 
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(U.S. Environmental Protection Agency, 1989). A 1991 EPA analysis of their restrictions on 
Class IH wells concluded that since 1980, Class IH wells are safer than virtually all other 
waste disposal practices (U.S. Environmental Protection Agency, 1991). EPA studied over 
500 Class I wells in operation from 1988 to 1991 and found no failures known to have 
affected a USDW. In response to a 1992 House of Representatives subcommittee inquiry, 
EPA (U.S. Environmental Protection Agency, 1993) provided state-by-state summaries of 
reported Class I well failure incidents between 1988 and 1992. This was defined as a break- 
down or operational failure of components of the well system, whether waste isolation loss 
occurred or not. Although component failures were reported during the survey period, no 
waste isolation failure occurred, and no waste from a Class I injection well reached a 
USDW. While these studies indicate the waste isolation effectiveness of current injection 
practices, they do not quantitatively address future risk. 

In summary, no studies were identified that provide full quantitative characterization of 
the risk of Class I hazardous waste injection wells. Some describe release incidents for well 
systems that cannot and do not exist under today's regulations. Others characterize only a 
portion of the risk, for example, estimating exposures that might occur after presuming a 
release (often by mechanisms that have never occurred). Others demonstrate that releases 
have not occurred under current practices, but do not characterize the likelihood that 
releases might occur in the future. To properly assess the environmental risks posed by Class 
I injection wells, it is critical that the probability of loss of waste isolation be quantitatively 
assessed. Waste volumes and concentrations corresponding to realistic release scenarios 
should be included in the assessment. 



10.3 METHODOLOGY 

To quantitatively evaluate environmental risks posed by Class IH well injection, it was 
necessary to develop a detailed characterization of how the siting, construction, design, 
operation, testing, and maintenance of a Class IH well system function as a whole to ensure 
waste isolation (Buttram, 1986; CH2M Hill, 1986a; Underground Injection Practices 
Council, 1986; SCS Engineers, 1985; Warner and Lehr, 1977). The critical elements of this 
system that are important in maintaining waste isolation are singled out for special attention. 
Inherent in this approach is a systematic identification and depiction of events and condi- 
tions that could result in loss of waste isolation. This information was gathered from histor- 
ical records on well failure events, and obtained from interviews with injection well 
construction, maintenance, and testing practitioner; operators of injection wells; and the 
agencies that regulate them. From this information, a comprehensive set of scenarios depict- 
ing the ways in which a typical Class IH injection well system could fail to isolate waste 
was developed. The probability of waste isolation loss in each of these scenarios was then 
quantified. Uncertainties in the analysis were given explicit quantitative treatment using 
Monte Carlo analysis. 

More specifically, the techniques of probabilistic risk assessment (PRA) were employed. 
PRA is a generally accepted approach for analyzing risks that arise through failure of engi- 
neered systems. In this case, PRA was used to identify sequences of events by which waste 
isolation could fail and result in waste reaching the lowermost USDW, and to characterize 
the probabilities of these event sequences. The results quantitatively and probabilistically 
demonstrate the degree of certainty that waste injected in this manner will effectively remain 
isolated and pose no future risk. The outcome of interest to this study was that the loss of 



10.4 Class IH Injection Well System Definition 



97 



waste isolation by release to the lowermost USDW could be due to any cause. Factors con- 
sidered included: 

• Errors in site selection or characterization, such as inappropriate or incompatible geology, 
unidentified abandoned wells, undetected geologic faults, or incorrect characterization of 
waste migration potential. 

• Geologic or engineered system failures, such as seismic fracturing of confining zones, 
tubing, or casing breaches, annulus fluid pressure loss, or alarm failures. 

• Operator errors, such as failure to respond to alarms, failure to detect leaks during test- 
ing, overpressurizing, or injecting incompatible waste. 

• Other possible human errors, such as inadvertent extraction of waste in the future. 
The following steps were taken, and detailed discussion of each follows: 

1. The Class IH well system, individual components, and conditions on which the PRA is 
based were defined. 

2. FMEA was performed with the assistance of injection well experts. 

3. Based on FMEA results, event and fault trees were developed, depicting the sequence of 
events that must occur for waste isolation to be lost. 

4. Based on historical or expert information, probability distributions characterizing the 
uncertainty in the frequency of occurrence of the various failures and other events were 
developed. 

5. Boolean logic and Monte Carlo analysis were used to combine the frequencies of inde- 
pendent and dependent events as depicted in the event and fault trees to estimate the 
overall probability of waste isolation loss for a Class IH well. 



10.4 CLASS IH INJECTION WELL SYSTEM DEFINITION 

In order to quantitatively assess the risk of loss of waste isolation from Class IH injec- 
tion wells, the injection well system must be defined at a high enough level of detail so that 
specific event sequences can be identified and their frequencies quantified. At the same 
time, the system definition must not be so unique that its methodologies and conclusions 
cannot be generalized to the population of Class IH wells as a whole. The Class IH well sys- 
tem definition used for this study was based on the minimal design and operation features 
allowed under current regulations; this ensures the broadest applicability of this study's 
results and conclusions. The regulatory system is sufficiently effective to eliminate the pos- 
sibility of any Class IH injection wells that do not at least meet the system definition. This 
conclusion was verified by discussions with state and EPA officials, a review of the current 
EPA injection well database (U.S. Environmental Protection Agency, 1996), and a random 
survey of Class I injection well operators of about 20% of the currently operating Class IH 
wells (Woodward Clyde Consultants, 1995). It was nonetheless appropriate to evaluate the 
possible failure of certain elements of the regulatory process that influence the effectiveness 
of waste isolation; this was done (e.g., the possibility that an unplugged well in the area is 
unaccounted for in the site review was included in the study). 

The design and operation features of the system analyzed are listed in Table 10.1, and a 
diagram of the system is shown in Figure 10.1. As a standard Class IH injection well, the 
system is assumed to comply with the requirements of the Code of Federal Regulations, 
Chapter 40, Parts 146 and 148, and Part 267 (Subpart G). The salient features of these 
requirements with respect to waste isolation are listed in Table 10.1. It is assumed that the 
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Table 10.1. Class IH well system definitions — design and operating features 



Waste isolation element Design or operating feature 



Applicable regulation 


Complies with 40 CFR 146 Subpart G 


Site selection and characterization 


Area of Review: 2-mile radius. 




"No-migration petition" for injection of 




restricted wastes. 


Geologic barriers 


Two confining layers 




between the injection zone and the 




lowermost USDW 


Engineered barriers 


Surface casing set below lowermost USDW. 




Casing completed with continuous cement. 




Liquid-based annulus pressure barrier 


Testing, monitoring, and inspection 


Equipped with auto-alarm 




and a full-time operator. 




Annual Radioactive Tracer survey or 




OA log for fluid movement temperature, 




and noise logs once every 5 years 



well operator has prepared a no-migration petition, which is required to receive a permit to 
inject restricted wastes. The no-migration petition results in a marked increase in site and 
system scrutiny by both the industry and the regulators. The operator must demonstrate 
through modeling that no migration of the waste will occur from the injection zone while 
the waste remains hazardous (or for 10,000 years). Petitions such as the no-migration peti- 
tion extensively document the local geology and faults, the well design, the operation and 
maintenance procedures, comprehensive local well surveys, and fate and transport through 
mathematical modeling. In the process of characterizing the proposed injection site, an area 
of review (AOR), extending for a two-mile radius around the site, must be investigated. The 
impact of these extensive analyses and investigations need to be considered in assessing the 
probability of release. 

The geologic features of the system analyzed are depicted in Figure 10.1. The injection 
zone is the permeable subsurface rock that receives the waste. Class I injection well depths 
range from 1700 to 9500 ft nationwide (U.S. Environmental Protection Agency, 1996). 
Typically, the USDW and injection zone are separated by several thousand feet (U.S. 
Environmental Protection Agency, 1996). The injection zone is required to be separated 
from the USDW by at least two confining zones consisting of dense rock or other geologic 
formations impermeable to fluid migration. For this assessment, it was assumed that only 
two confining zones exist. In actual practice, Class I injection wells have more than two con- 
fining layers (U.S. Environmental Protection Agency, 1996), which are separated by non- 
potable water-bearing zones called "buffer zones." Studies have shown that if waste fluid 
were to migrate through a confining zone, there would be significant dilution in each suc- 
cessive buffer (Don L. Warner, Inc. and Engineering Enterprises, Inc., 1984; U.S. 
Environmental Protection Agency, 1990). This phenomenon has not been accounted for in 
exposure assessments to date (The Cadmus Group, Inc., 1995), which generally assume that 
the waste inventory is released directly to a USDW. 

Injection wells are constructed by extending concentric pipes or casings down the drilled 
well boring. Corrosion-resistant materials such as steel alloy or fiberglass are used in the 
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Fig. 10.1. Simplified Class I injection well system assumed for PRA. 



casings. The upper and outermost casing (Fig. 10.1) is called the surface casing, and is 
required by regulation (Table 10.1) to extend below the base of the lowermost USDW. As 
shown in Figure 10.1, the surface casing might not extend into the uppermost confining 
zone. This could result in a section of the well without surface casing to pass through an area 
of non-confining rock, below the lowermost USDW, but above the confining zones (see 
Location A in Fig. 10.1). This area is important in the PRA, because it is the location with 
the least number of barriers to loss of waste isolation. 

Within the surface casing is the long string casing, which extends to the injection zone. 
Chemically resistant cement or epoxy resin is used to fill the borehole space outside the 
surface casing, between the surface and long string casings; and the borehole space outside 
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the long string casing, from top to bottom. These casings were assumed to be completed 
with continuous cement (Table 10.1); this effectively binds the casings together and seals 
the well boring along its entire length, creating a single unit. Nonetheless, in this conser- 
vative assessment, the cement was considered a barrier for vertical but not horizontal fluid 
migration. 

A smaller steel or fiberglass pipe, the injection tube, extends the length of the casings 
through a lower seal (the packer) into the injection zone. Waste pumped from above flows 
into and is forced out of the portion of the borehole that extends into the injection zone. 
This is known as the injection interval, and may be uncased or fitted with a perforated sec- 
tion to prevent loose material from entering and potentially clogging the borehole or injec- 
tion tube. 

The space between the long string casing and the injection tube (the annulus) is sealed 
at the surface by the wellhead and at the base by the packer, and filled with a noncorrosive 
fluid under positive pressure in excess of the injection tube pressure. In Class IH wells, the 
annulus fluid is required to function as an additional pressure barrier to prevent waste fluid 
from leaking through the injection tube or the packer. Measurement of the fluid pressure and 
volume within the annulus is used to monitor the mechanical integrity of the injection tube, 
long string casing, and packer. 

An operating Class IH injection well system incorporates the redundancy of safety 
systems that typically characterize safe engineering design. The long string casing is 
continuously cemented from top to bottom. Along with the annulus fluid pressure, the 
casing is a barrier to an injection tube or packer leak, and the cement provides a barrier 
to vertical migration of any fluid that would escape along the outside of the casing or 
the borehole. The surface casing presents another barrier to waste migration in the portion 
of the well passing through USDWs. Finally, the annulus is sealed at both ends and is 
pressurized. Because the pressure in the annulus is higher than the pressure used to inject 
the waste (positive pressure), any leaks in the injection tube would result in annulus fluid 
being forced into the tube rather than waste fluid escaping into the annulus. The fluid 
pressure is required to be continuously monitored both by automated alarm systems 
and manually by a full-time operator for loss of pressure or volume. Such loss could 
indicate that the system integrity is compromised (e.g., pump failure, packer failure, casing 
failure). Most Class IH systems include automatic shutdown of the injection pumps upon 
alarm, although it was conservatively assumed that the system assessed did not have an 
auto-shutdown feature. Of course, the injection pumps shut down upon loss-of-power 
events. 

Class IH wells are monitored annually for a number of factors related to waste isolation, 
including injection zone pressure buildup, water quality monitoring in lower USDW in 
some cases, and required mechanical integrity testing to detect fluid movement outside the 
long string casing. Such testing includes annual radioactive tracer or oxygen activation log- 
ging, as well as temperature and noise logging at least once every 5 years. Casing inspec- 
tion logs are required whenever the injection tube is removed. When migration or flaws are 
detected, they are repaired. 

In summary, the system assessed was a Class I hazardous waste injection well that min- 
imally complies with 40 CFR 146 Subpart G requirements. The system components 
included in the PRA included geologic, engineered, and human elements. Finally, the sys- 
tem was assumed to be operating, with an operating lifetime of 30 years. Post-operating 
risks analyzed included the possibility of inadvertent human extraction of waste and migra- 
tion through breached geologic confining zones. 
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FMEA was performed on the Class IH injection well system defined above. This is a 
systematic technique for identifying all means by which the injection well components 
could fail, and what the effect could be with respect to waste isolation. Each component and 
activity identified as important was evaluated by: 

• Identifying all possible failure modes of the component (e.g., injection tube leaks, injection 
tube crushes, injection tube plugs, etc.). 

• Identifying possible reasons for these failure modes (e.g., corrosion, improper installation, 
etc.). 

• Assessing possible consequences of the failure mode (e.g., loss of annulus pressure, 
fracturing of injection zone, etc.). 

• Identifying system features that serve to prevent the failure or mitigate its consequences 
(e.g., the annulus fluid is under positive pressure). 

The FMEA process is a brainstorming activity that does not exclude events based on the 
probability of their occurrence. All plausible events are considered even if they are consid- 
ered to be of very low probability. The results of the FMEA are qualitative in nature and are 
not in themselves suitable for quantifying risk. Because the FMEA identifies all potential 
failure modes for the system, failure mechanisms of the components, and the safety systems 
designed to prevent or mitigate failures, it creates a level of understanding that can be used 
to develop the probabilistic framework to quantify risk (i.e., the event and fault trees). 

The FMEA process in this assessment was one through a series of workshops with deep- 
well injection operators and expert consultants. In addition, FMEA results were presented 
at a number of Ground Water Protection Council national meetings, and refined through 
input obtained from injection well operators, maintenance and testing professionals, and 
state and EPA regulatory staff who attended the meetings. 

10.6 EVENT AND FAULT TREE DEVELOPMENT 

Based on the understanding gained from the FMEA, event trees were developed that 
identify potential sequences of events that could result in a release to the lowermost USDW. 
Seven possible initiating events were identified that characterize the overall risk of waste 
isolation loss for the Class IH injection well system defined. The seven initiating events 
identified were: 

1 . Packer leak 

2. Major packer failure 

3. Injection tube leak 

4. Major injection tube failure 

5. Cement microannulus leak 

6. Confining zone(s) breach 

7. Inadvertent injection zone extraction 

Once initiated, the likelihood of waste isolation loss depends on the subsequent failure of 
additional components, barriers, and backup systems within a relevant time domain. The event 
tree is a diagram that depicts the sequence of events and component failures that must follow 
for a release to the lowermost USDW to occur. A pathway can be traced through the event tree 
along its branches, depicting different combinations of failures and successes of system com- 
ponents and operational events that function together to prevent or result in waste isolation loss. 
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Fault trees were developed for three events of sufficient complexity, involving multiple 
events themselves. These three events were: loss of the annulus pressure barrier, lower geo- 
logic confining zone breach, and upper geologic confining zone breach. 

The event and fault trees for each initiating event sequence are discussed in more detail 
below, with estimated frequencies of occurrence for events in the trees described first. 

10.7 EVENT-FREQUENCY-DISTRIBUTION DEVELOPMENT 

Perhaps the most problematic part of this PRA was estimating frequencies of occurrence for 
events in the trees. For many of these events, occurrence was so rare and data were so sparse 
that a confident point estimate for the frequency of occurrence could not be established. 
Consequently, uncertainty about occurrence frequencies was given explicit quantitative treat- 
ment in the assessment. Probability distributions of event occurrence frequencies were devel- 
oped, either based on available occurrence data or expert judgment. These distributions are 
shown in Table 10.2, where the event names correspond to event names appearing on the event 
and fault trees in Figures 10.2-10.11. Simultaneous occurrence of the events in a sequence is 
required for a release to occur. The period of time during which simultaneous occurrence could 
feasibly happen before detection and remedy would occur was assumed to be one day. Thus, 
the frequencies shown in Table 10.2 are based on a daily time frame, unless they are on-demand 
probabilities of a failed state or response once a sequence is in progress (e.g., the probability 
that an alarm fails or the probability that a discontinuity is present in the confining zone). 

10.8 QUANTITATIVE ANALYSIS OF EVENT TREES 

In PRA, event frequencies are combined according to the logic of the event and fault trees 
using Boolean algebra. The result is the estimated frequency (or probability) of a release to the 
lowermost USDW over the lifetime of the Class I hazardous waste injection well. Since uncer- 
tain event frequencies in this assessment were characterized by probability distributions, these 
distributions were propagated through the Boolean algebra calculations using Monte Carlo 
analysis. The result is expressed as a distribution of the probability that waste isolation will be 
lost during the lifetime of the injection well. This approach enables one to draw conclusions 
as to the certainty of the waste isolation loss risk estimates, and to conduct sensitivity analy- 
ses to identify which individual events contribute the most uncertainty to the risk estimates. To 
facilitate such analyses, both fault and event tree probabilities were placed into Microsoft 
Excel™ spreadsheets while the random sampling and generation of stochastic results were per- 
formed using Crystal Ball™. Latin Hypercube Sampling (LHS) was used to generate input 
values for all distributions. The analysis was performed with 5000 iterations to provide the 
best possible estimate of the percentiles. For operator errors likely to involve the same opera- 
tor or similarly trained operators, the frequency distributions were correlated. A parametric 
sensitivity analysis was also performed based on percent contribution of uncertain event 
frequencies to the overall variance in the loss of waste isolation probability distribution. 

10.9 PROBABILISTIC RISK ASSESSMENT (PRA) RESULTS 

Using the event and fault trees, the risk of waste isolation loss and release to the USDW over 
the 30-year life of a Class IH waste injection well was characterized quantitatively. Most of the 
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trees represent the daily probability of the event sequence, and their results were converted into 
30-year probabilities for presentation (see Table 10.3). Events that are independent of time (i.e., 
inadvertent injection zone extraction) are presented as event probabilities. The cumulative per- 
centile results of the analysis for each event sequence are presented in Table 10.3. Values shown 
in Table 10.3 are probabilities of the loss of waste isolation (i.e., release to the lowermost 
USDW) over the lifetime of the well. The cumulative percentile is the likelihood of being less 
than or equal to (i.e., likelihood of not exceeding) the corresponding loss of isolation risk. 

10.9.1 Packer Leak 

The initiating event in this sequence is the development of a leak in the packer at the base 
of the injection tube and pressurized annulus (see Fig. 10.2). If the packer leaks during 
injection, containment is maintained as long as the annulus pressure is greater than the injec- 
tion pressure. If the annulus pressure drops, containment will still be maintained by the long 
string casing. A leak in the long string casing might occur, but its location will be critical 
since this determines what additional failures must occur to lose containment. A long string 
casing leak in the area between the bottom of the surface casing and the upper confining 
zone (Location A) was assumed to result in a release to the lowermost USDW, even though 
current regulations require the surface casing to be set below the base of the lowermost 
USDW, into a confining bed. In addition, there actually may be significant geologic inter- 
action between this point and the USDW. If the long string casing leak is located above the 
base of the surface casing, a release to the USDW requires either a leak in the surface cas- 
ing or a crack (microannulus) in the long string cement casing that opens to Location A. A 
leak below the confining layer(s) requires a breach of the geologic barrier(s) or a microan- 
nulus that opens to Location A. 

Two component failures in the event tree are described by fault trees: the first quantifies 
the probability that the annulus pressure is less than the injection pressure, while the second 
addresses the probability that the confining zone is breached. These fault trees are presented 
in Figures 10.3 and 10.4, respectively, while the event probabilities associated with these 
fault trees are shown in Table 10.2. 

The PRA results of the packer leak scenario indicate that the probability of waste isola- 
tion loss over the life of the well from this initiating event is on the order of 10~ 17 -10~ 18 (see 
Table 10.3). The annulus pressure is the primary barrier to loss of containment, and the 
probability of pressure loss is extremely low, since it would require simultaneous alarm and 
full-time operator failures. In fact, a difference in pressure between the annulus and injec- 
tion fluids does occur, but the high reliability of the redundant auto-alarm and full-time 
operator keeps the probability of this extremely low, resulting in a pressure barrier loss dur- 
ing injection. Additionally, the location of a long string casing leak is a critical factor in 
waste isolation loss, as it determines the presence or absence of additional barriers. 

10.9.2 Major Packer Failure 

This event is distinguished from the packer leak event in that it involves a complete and sud- 
den loss of the packer and the subsequent rapid loss of annulus pressure (see Fig. 10.5). 
Without the annulus pressure barrier, the containment now depends on the integrity of the 
long string casing and associated components. The sequence of component failure leading 
to waste isolation loss thereafter is similar to the packer leak tree, except there is no 
annulus pressure barrier. 
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A major packer failure is a lower probability event than a packer leak. Despite this, the 
assumed absence of annulus pressure eliminates an important barrier to waste isolation loss 
and results in a higher risk than for a simple packer leak on the order of 10~ 8 -10~ 9 (see Table 
10.3). With the loss of pressure, the waste is assumed to mix with the annulus fluid in the 
column. As above, the location of the long string casing is a critical factor in waste isolation 
loss, as it determines the presence or absence of additional barriers. 

10.9.3 Injection Tube Leak 

This initiating event involves a leak in the injection tube above the packer (see Fig. 10.6). 
Since it is not a catastrophic failure, annulus pressure is maintained. Aside from the location 
of the leak, the events and the sequence leading to containment loss is identical to that of 
the packer leak scenario. Similar to the packer leak, the results indicate that the probability 
of waste isolation loss over the life of the well is extremely low, on the order of 10~ 17 -10~ 19 
(see Table 10.3). As with the packer leak, the annulus pressure is the primary barrier to loss 
of containment. Additionally, the location of the long string casing remains a critical factor 
in waste isolation loss to the accessible environment, as it determines the presence or 
absence of additional barriers. 

10.9.4 Major Injection Tube Failure 

This initiating event is similar to the major packer failure, and is characterized by a catastrophic 
failure of the injection tube above the packer, with the resulting loss of annulus pressure (see 
Fig. 10.7). Aside from the location of the failure, the sequence of events leading to possible con- 
tainment loss is identical to that of the major packer failure scenario discussed above. 

A major injection tube failure has a lower probability of occurring than an injection tube 
leak. As with the major packer failure, the assumed immediate loss of annulus pressure 
eliminates an important barrier to waste isolation loss and results in a higher risk than a sim- 
ple leak of the injection tube, on the order of 10~ 8 -10~ 9 (see Table 10.3). With the loss of 
positive pressure, it is assumed that the waste mixes with the annulus fluid and escapes 
through the leak in the long string casing. As in all these scenarios, the location of the long 
string casing is a critical factor to waste isolation loss. 

10.9.5 Cement Micro annulus Failure 

Radiotracer studies are performed annually on Class IH wells to detect migration. This event 
sequence involves the possibility that an extended vertical opening (i.e., microannulus) in 
the cement surrounding the long string casing remains undetected and results in waste iso- 
lation loss (see Fig. 10.8). The cement extends from the surface through all confining lay- 
ers to the injection zone. Should a microannulus crack open in the cement, extend from the 
injection zone through the upper confining zone, and remain undetected, waste injected 
under pressure could possibly migrate up to Location A and then to the USDW. 
Alternatively, waste could migrate only up to a location below the upper confining zone, and 
then the upper confining zone could breach. An additional fault tree is needed to estimate 
the probability that the upper confining zone will be breached. This fault tree is presented 
in Figure 10.9, with the corresponding probabilities presented in Table 10.2. 

The probability that loss of waste isolation will result under this scenario was calculated to 
be on the order of 10 -6 -10 -8 (see Table 10.3). The event sequence is controlled by the location 
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Fig. 10.9. Fault tree for upper confining zone breach in a Class I hazardous waste injection well. 



to which the microannulus extends. In this case, it was assumed to extend from the injection 
zone to the USDW. The greatest uncertainty lies in whether such an extended and transmis- 
sive microannulus will occur, and if the waste fluid can travel that far given that the injection 
zone represents the path of least resistance to the pressurized waste stream. Additionally, the 
annual testing for fluid migration also limits the risk to loss through this mechanism. 



10.9.6 Confining Zone Breach 



The initiating event in this scenario is a transmissive breach of the lower confining zone 
(directly above the injection zone) (see Fig. 10.10). The probability of this event is based on 
the fault tree analysis first developed for the packer leak (see Fig. 10.4). Once the lower con- 
fining zone is breached, the remaining barriers to waste isolation loss are: 

1 . The waste is sufficiently buoyant to penetrate the lower confining zone breach. 

2. Groundwater monitoring fails to detect waste outside of the injection zone. 

3. The upper confining zone is breached. 

4. The waste is sufficiently buoyant to penetrate the upper confining zone breach. 

A breach in the confining zone requires that all confining zones must be completely 
breached with transmissive openings. This must remain undetected in spite of ongoing mon- 
itoring of pumping pressure and volumes, injection zone pressure, and groundwater quality. 
Additionally, the waste must have a driving force in all zones to be sufficiently buoyant to 
penetrate the USDW above, and there must be no bleed-off into the buffer aquifers between 
the confining zones. This scenario has a probability of waste isolation loss on the order of 
10- 10 (see Table 10.3). 
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10.9.7 Inadvertent Injection Zone Extraction 



Given the depth of most injection wells, future human intrusion into the injection zone is 
unlikely (see Fig. 10.11). An extraction scenario also does not rely on any additional com- 
ponents of the operating system. This initiating event assumes extraction of injected waste 
with the additional sequence probabilities included to assess the possibility that the extrac- 
tion of the injection zone material goes unnoticed by the well user. The time domain is not 
relevant, as all such activities are assumed to have occurred after a system closure. 

This scenario is the most difficult to estimate the probability of occurrence. Nonetheless, the 
possibility that extraction of isolated waste will occur after closure was calculated to be less 
than 10~ 6 (see Table 10.3). Since injection zones are more than 1000 ft deep and presumably 
underlie most accessible and higher quality aquifers, it is unclear why water from the injection 
zone would be extracted by anyone. Depending on timing and location, the waste may no 
longer present a potential hazard, or the plume may not be intersected by the extraction wells. 

10.9.8 Incompatible Waste Injection 

The issue of incompatibility of wastes and well components or geologic formations was 
covered under the outcomes of the other event trees. Carbon dioxide or other gas formation 
may result in packer blowout, rupture of the injection tube, transmissive geologic fractur- 
ing, or wellhead blowout. Each of these events are covered by the event trees for packer or 
injection tube failure or by the fault tree for confining zone breaches, or are considered spills 
and not relevant to this evaluation. Corrosion of rock or other system components are cov- 
ered under the fault tree for the lower confining zone breach or the event tree for the rele- 
vant system component (i.e., injection tube leak or failure). A chemical interaction may also 
result in a plug forming in the system, resulting again in packer blowout, failure of the injec- 
tion tube, or fractures of the different confining zones in response to a pressure buildup. 
These are addressed by event trees for the confining zone breach and the packer or injection 
tube failure, or by the fault tree for the breach of the lower confining zone. 

10.10 OVERALL LOSS OF WASTE ISOLATION RESULTS 

Based on the PRA conducted for Class IH wells, the 90th percentile risks for the indi- 
vidual scenarios detailing the potential loss of waste isolation range from a low of 10" 17 
(packer leak) to a high of 10~ 6 (cement microannulus) (see Fig. 10.12). The probability for 
all events combined (assuming that these risks are additive) resulting in a loss of waste iso- 
lation is between 10~ 6 and 10~ 8 (Fig. 10.12). The event sequences that are predominant con- 
tributors to overall risk are the microannulus failure and the possibility of inadvertent future 
injection zone extractions. The sensitivity analysis (Fig. 10.13) identified the following con- 
tributions to overall uncertainties about probability of loss of waste isolation: 

• Distance that waste migrates along a vertical cement microannulus (52% of the variance). 

• Likelihood of future extraction from the injection zone (17% of the variance). 

• Probability that at the time of future extraction the waste is no longer hazardous or the 
plume is not present (15% of the variance). 

• Likelihood that the fluid testing fails to detect migration (8% of the variance). 

• Likelihood that the extracted material is unrecognized as waste by the well user (3% of 
the variance). 
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Fig. 10.12. Probability distribution for total loss of waste isolation risks in a Class I hazardous 

waste injection well. 



Sensitivity Chart 
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Fig. 10.13. Sensitivity chart of relative contributions to overall uncertainties for loss of waste 

isolation risks. 



10.11 CONCLUSIONS AND RECOMMENDATIONS 

Because of the conservative assumptions used for failure event probabilities and the explicit 
treatment given to uncertainties in this analysis, we believe that the risk of loss of waste isola- 
tion from Class IH wells is less than 10~ 6 . The low risk is due in large measure to the use of 
redundant engineered systems and geology to provide multiple and diverse barriers to prevent 
release of waste to the accessible environment. This is aided in part by the fact that deep-well 
injection is a simple design relying on passive systems to minimize failure modes and frequen- 
cies. The annulus pressure is a critical barrier and performance monitor, and it displays a high 
reliability due to the presence of automatic alarms and shutoffs, and full-time operators. 
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The risk of waste isolation loss is dominated by two failure scenarios: 

1. The possibility that a transmissive microannulus develops in the cemented borehole 
outside the long string casing, and extends from the injection zone up past the geologic 
confining zones, and 

2. The possibility of inadvertent future extraction of injected waste. 

Uncertainty about the overall risk to waste isolation is also dominated by events associ- 
ated with these two scenarios. For example, in developing the frequency distribution for the 
microannulus initiating event (LSCEMLEAK in Fig. 10.8), it was conservatively assumed 
that "vertical migration detected" events in the well failure database (U.S. Environmental 
Protection Agency, 1993) were equivalent to the occurrence of a transmissive microannulus 
extending from the injection zone through one or both of the confining layers; however, Class 
IH well operators contend that evidence of a microannulus extending from the injection zone 
through the confining layers has not been found. Thus, a highly uncertain event initiates the 
highest-risk sequence, and is therefore treated with significant conservatism in the PRA; this 
points to the need for more complete data on the location, duration, and length of detected 
microannuli, rather than just noting the number of times that vertical migration is detected. 

Numerous conservative assumptions were used in this PRA that, combined with the 
explicit treatment of uncertainties (i.e., the Monte Carlo analysis), lend confidence to the con- 
clusions of low risk. Credit was not taken for cement as a horizontal barrier to waste migra- 
tion. Likewise, in using the well failure database (U.S. Environmental Protection Agency, 
1993), all events termed "failure" for packers, tubing, and casing were assumed to be 
breaches of sufficient size and duration to transmit waste. As explained above, "vertical 
migration detected" events were similarly assumed to represent a complete transmissive path- 
way from the injection zone, and up past the geologic confining layer(s). In the event of a 
breach of the confining layers, the buoyancy of the waste and the injection pressure were 
assumed to be high enough to drive migration through breaches of multiple confining layers. 
Significant bleed-off and attenuation that would occur in the intervening buffer aquifers were 
not taken into account. Only two geologic confining layers were assumed throughout this 
PRA, although survey information indicates that three or more confining zones are usually 
present. Published human-error data were used as the lower bound on probability distribu- 
tions for events that assumed an equal probability for error rates to be an order of magnitude 
higher than published rates. While automatic shutdown of the injection well pumps is a typ- 
ical operating feature of most Class IH wells, no automatic shutdown was assumed for this 
PRA. It was further assumed that a release between the surface casing and the upper confin- 
ing zone was equivalent to a release to the USDW, and that releases below the confining 
zones involved only one confining zone barrier to the USDW. Finally, the timing between 
independent occurrences in the various event and fault trees was assumed to be coincident for 
sufficient duration prior to detection and corrective action for a release to the USDW to occur. 

Since the failure location and timing of the individual events are critical to the development 
of these release scenarios, uncertainty would be reduced and knowledge improved if this 
information were collected and included in the databases maintained on Class I well failures. 
The presence, degree of training, and diligence of the operator is important in preventing sys- 
tem failure and loss of waste isolation. This is especially critical in maintaining the annulus 
pressure, which is a major barrier to loss of waste from the system. Uncertainty over the exis- 
tence and transmissivity of extended vertical cement breaches is important. Experimental or 
field data on the microannulus assumed to exist in these scenarios would assist in reducing this 
uncertainty and improving the risk estimates. Finally, we recommend that future assessments 
of the potential environmental risks associated with deep- well injection explicitly take into 
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account the probability of release and the amount of waste that could be released by the 
mechanisms of feasible system failure scenarios. 
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APPENDIX: BASIS FOR EVENT FREQUENCY PROBABILITY 
DISTRIBUTIONS 

There are 42 events identified in the PR A (Table 10.2) for which failure rates are needed 
to calculate event- and fault- tree probabilities. For many of these events, occurrence is so 
rare and data are so sparse that a confident point estimate for the frequency of occurrence 
cannot be established. Directly applicable data on the frequency of most events were not 
found. In common practice, most component failure modes are identified and corrected dur- 
ing required testing and maintenance, and thus may not be recorded as a failure event per 
se. More than one- third of the events involved some type of human error. Human error fre- 
quency data are available (Swain and Guttman, 1980; Swain, 1987); however, their direct 
applicability to the human tasks involved in Class IH wells is uncertain. 

Consequently, uncertainty about occurrence frequencies was given explicit quantitative 
treatment in the PRA. Probability distributions of event occurrence frequencies were devel- 
oped, either based on available occurrence data or expert judgment. In general, probability 
distributions for event frequencies were derived as follows: 

1. A 1993 EPA reply to a House of Representatives subcommittee inquiry (U.S. 
Environmental Protection Agency, 1993) provided state-by- state summaries of certain 
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reported types of Class I injection well failure events between 1988 and 1992. Numbers 
of events were reported for 469 Class I wells (hazardous and nonhazardous) located in 
12 states. Events reported included tubing, casing, and packer leaks; and waste migration 
on the outside of the long string casing (i.e., cement microannulus). The number of 
reported events was divided by 855,925 well days (469 wells x 5 yr x 365 days/yr) to 
derive an estimate of the average daily occurrence rate for each type of event. Because 
nonhazardous wells have less regulatory restrictions than hazardous, it was a conser- 
vatism to include these data. 
2. Modeling these failure rates with a binomial distribution, it is possible to determine the 
confidence intervals for a given average failure rate. Estimations of the 90th percentile 
upper confidence limit of the average failure rates were calculated using methods out- 
lined by McCormick (1981). These are shown in Table A.l. 



Table A. 1. 



Component 


Number of 


90th percentile confidence limit 




reported failures 


of average failure rate (day -1 ) 


Tube 


48 


6.80E-05 


Casing* 


28 


4.20E-05 


Packer* 


31 


4.60E-05 


Waste migration^ 


5 


1.10E-05 



Three recorded "annulus leak" events were included because it could not be determined if these were casing- or 
packer-related. 

tr Trris category is assumed to be a surrogate for casing cement leak events. 



Probability distributions representing uncertainties about frequency rates of these events 
(ITUBLEAK, LSTRINGLEAK, PACKLEAK, LSCEMLEAK) were developed by using 
these upper confidence limits for the average rate as the rate parameter in a Poisson distri- 
bution. The Poisson distribution is commonly used in reliability analyses to describe ran- 
dom failures in a system that cause irreversible transitions in the system (Clemen, 1991) 
such as a loss of waste isolation. The Poisson distribution requirements (Clemen, 1991), 
which are met for this application, include: 

• Events can happen at any time within the day. 

• The probability of an event is small. 

• Events can happen independently of other events. 

• The average number of events per day does not change with time. 

3. For events involving typical components of any industrial system, such as valve, pump, 
control system, or alarm failures, occurrence frequencies were obtained from available 
industrial reliability databases (Davis and Satterwhite, 1988; Envirosphere Company, 
1988; Lannoy and Procaccia, 1996). 

4. Most human-error rates were derived from available human reliability data for similar 
activities. Usually, these human error data have been compiled for highly trained and 
scrutinized occupations such as nuclear power plant operators (Swain and Guttman, 
1980; Swain, 1987) and firemen (Davis and Satterwhite, 1988; Envirosphere Company, 
1988). While Class I hazardous waste injection well operators arguably fall into this 
same category, this assessment conservatively assigned human-error rates as the lower 
bound of the distribution, with an upper bound set at a higher order of magnitude. 
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5. For events in which data are entirely lacking, the authors relied on professional judgment, 
shaped in part by the experience of deep-well operators and regulators elicited during 
workshops held in conjunction with Ground Water Protection Council national meetings. 
To account for uncertainty in professional judgment, relatively large bounds of uncertainty 
were applied to frequencies derived in this manner. When the uncertainty was high, the 
range of the distribution would span several orders of magnitude. In some cases, the fre- 
quency was set at a maximum value; for example, the probability that injected fluid is suf- 
ficiently buoyant to penetrate a lower confining zone breach was assumed to be 1 . 
The probability distributions representing uncertainty about event frequencies are summa- 
rized in Table 10.2 of the chapter and discussed individually below. 



Event: 
Description: 
Probability: 
Basis: 



Event: 
Description: 
Probability: 
Basis: 



Event: 
Description: 
Probability: 
Basis: 



Event: 
Description: 
Probability: 
Basis: 



ITUBLEAK 
Injection tube leak. 

Poisson distribution with 6.8E-05/day rate. 

This event quantifies the probability that the injection tube carrying waste 
to the injection zone will develop a leak. Based on compilation of state- 
by- state data analyzed as discussed above. 

ITUBFAIL 

Sudden major failure and breach of the injection tube. 
l/100th of ITUBLEAK probability. 

ITUBFAIL assumes a sudden and major failure of the injection tube such 
that the annulus pressure is lost simultaneously. Based on professional 
judgment, the likelihood of the injection tube failing catastrophically was 
estimated to be 1/1 00th the probability of a leak. Thus the ITUBFAIL 
probability was assigned a value 0.01 times the ITUBLEAK probability. 

ANNPRESSLO 

Annulus pressure drops below injection pressure. 
Determined by fault tree analysis. 

Due to the multiple components associated with this failure event, an 
ANNULUS PRESSURE BARRIER FAILURE FAULT TREE (Fig. 10.3) 
was developed and used to evaluate the event probability. The resulting 
cumulative distribution for this event frequency is: 



10th percentile 


1.5E- 


-12 


20th percentile 


2.6E- 


-12 


30th percentile 


3.8E- 


-12 


40th percentile 


5.2E- 


-12 


50th percentile 


7.0E- 


-12 


60th percentile 


9.3E- 


-12 


70th percentile 


1.2E- 


-11 


80th percentile 


1.7E- 


-11 


90th percentile 


2.4E- 


-11 


LSTRINGLEAK 







Long string casing leak. 

Poisson distribution with 4.2E-05/day rate. 

Based on compilation of state-by- state data analyzed as discussed above. 
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Event: LSCASEFAIL 

Description: Sudden and major failure and breach of the long string casing. 
Probability: l/100th of LSTRINGLEAK probability. 

Basis: LSCASEFAIL assumes a sudden and major failure of the long string casing 

such that the annulus pressure is lost simultaneously. Based on professional 
judgment, the likelihood of the long string casing failing catastrophically 
was estimated to be 1/1 00th the probability of a leak. Thus the LSCASE- 
FAIL probability was assigned a value 0.01 times LSTRINGLEAK. 

Event: SURFCASELEAK 
Description: Surface casing leak. 

Probability: Poisson distribution with 4.2E-06/day rate. 

Basis: The surface casing surrounds the long string casing and provides one of 

the final engineered barriers to the USDW. Failure probabilities are 
derived from LSTRINGLEAK with a correction of 0. 1 to account for the 
fact that the surface casing is subject to less stress than the long string cas- 
ing, and it is shorter and closer to the surface, making it less likely to be 
subject to construction failure modes. 



Event: LSCEMLEAK 

Description: Long string casing cement microannulus allows fluid movement along 
casing. 

Probability: Poisson distribution with l.lE-05/day rate. 

Basis: Surrounding the entire length of the long string casing is cement, which 

fills the void between the casing and the surrounding geology. Given that 
there may be discontinuities in the cement pack, there is the probability 
that waste may migrate up the outer length of the casing through a 
microannulus discontinuity in the cement. Based on the state-by- state 
data responses for "waste migration," a failure rate parameter for the dis- 
tribution was determined using the methodology described above. 

Event: LOCATION A 

Description: Long string casing leak is located between surface casing and uppermost 
confining zone. 

Probability: Uniform distribution from 1.0E-02 to 5.0E-02. 

Basis: Given that a long string casing leak has occurred, the exact location along its 

entire length determines the likely migration route. If the leak occurs within 
the bounds defined by LOCATION A, migration to the USDW is assumed 
to be immediate and complete. Estimation of probability is based on profes- 
sional judgment and takes into account the length of casing in this location 
relative to the typical overall long string casing length. In addition, consid- 
eration was given to the fact that stresses on the casing increase with depth. 

Event: LOCATION B 

Description: Long string casing leak is located above the bottom of the surface casing. 
Probability: Uniform distribution from 1.0E-02 to 1.0E-01. 

Basis: The same logic applied to the determination of LOCATION A probability 

is used here. 
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Event: LOCATION C 

Description: Long string casing leak is located below the confining zone(s). 
Probability: l-Prob(LOCATION A)-Prob(LOCATION B). 

Basis: The final section of the casing string extends from the top of the upper- 

most confining zone to the injection zone. This represents the largest frac- 
tion of the casing length, and stresses increase with depth, so the 
likelihood for a casing leak is higher in this location. Given that a long 
string casing leak has occurred, the probabilities for LOCATION A, 
LOCATION B, and LOCATION C must sum to unity. Thus, an algorithm 
is included in the event tree for the Monte Carlo simulation that calculates 
the probability of LOCATION C based on the probabilities selected at 
each iteration for LOCATION A and LOCATION B. 

Event: MIGRATION A 

Description: Waste migrates up the microannulus to Location A between the surface 

casing and the upper confining zones. 
Probability: Uniform distribution from 1.0E— 04 to 1.0E— 02 

Basis: Radiotracer studies are performed annually on Class IH wells to detect 

migration. It is assumed that these studies do not always detect the formation 
of an extended vertical opening, i.e., a microannulus, in the cement sur- 
rounding the long string casing. If a microannulus extends from the injection 
zone through the upper confining zone, waste under pressure could migrate 
to Location A, and ultimately to a USDW. The probability of loss of waste 
isolation by this scenario is calculated to be on the order of 10~ 6 to 10~ 8 . 

Event: PACKLEAK 
Description: Packer leak. 

Probability: Poisson distribution with 4.6E-05/day rate. 

Basis: This event quantifies the probability that the packer will develop a leak. 

The packer seals the bottom of the annulus between the long string casing 
and the injection tube. The probability is based on compilation of state- 
by- state data analyzed as discussed above. 

Event: PACKFAIL 

Description: Sudden and major failure and breach of packer. 
Probability: l/100th of PACKLEAK probability. 

Basis: Using the same basis applied to other catastrophic failure events, a pro- 

fessional judgment of 1/1 00th of the probability of a leak was used for 
complete packer failure. 



Event: FLUIDTEST 

Description: Testing fails to detect injection fluid migration along outside of long 
string casing. 

Probability: Uniform distribution from 5.0E-04 to 5.0E-03. 

Basis: Regular testing is required to detect migration fluid along the outside of the 

casing material. Generally, the probability of failing to detect a leak is most 
likely due to operator error, either in the procedure or in the interpretation 
of results. Thus, the probability of failing to detect fluid migration is based 
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on the probability of operator — hence, human error. Studies prepared for 
nuclear power plant reliability analyses (Swain and Guttman, 1980; Swain, 
1987) are primary sources for human-error rates. These studies show that 
errors of omission for nonpassive tasks (maintenance, test, or calibration) 
occur at a rate of approximately 1.0E-03 per demand, with a range from 
5.0E-04 to 5.0E-03. It is assumed that a single failure to detect on demand 
(i.e., at the time of the test) results in significant fluid migration. 

Event: CONFINEBRCHL 

Description: Transmissive breach occurs through lower confining zone. 
Probability: Determined by fault tree analysis. 

Basis: Due to the multiple components associated with this failure event, a 

LOWER CONFINING ZONE BREACH FAULT TREE (Fig. 10.4 in 
chapter) was developed and used to evaluate the event probability. The 
resulting cumulative distribution for this event frequency is: 
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Event: CONFINEBRCHU 

Description: Transmissive breach occurs through upper confining zone. 
Probability: Determined by fault tree analysis. 

Basis: Due to the multiple components associated with this failure event, an 

UPPER CONFINING ZONE BREACH FAULT TREE (Fig. 10.9) was 
developed and used to evaluate the event probability. The resulting cumu- 
lative distribution for this event frequency is: 



10th percentile 


1.6E- 


-03 


20th percentile 


1.8E- 


-03 


30th percentile 


2.1E- 


-03 


40th percentile 


2.4E- 


-03 


50th percentile 


2.7E- 


-03 


60th percentile 


3.3E- 


-03 


70th percentile 


4.2E- 


-03 


80th percentile 


5.6E- 


-03 


90th percentile 


7.9E- 


-03 



Event: LBUOYANCY 

Description: Injection fluid is sufficiently buoyant to penetrate the lower confining 

zone breach. 
Probability: 1.0 
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Because fluid is being injected under pressure below the lower confining 
zone, it is conservatively assumed that this provides sufficient buoyancy 
to penetrate a breach. In general, in the absence of active injection 
pressure, it is unlikely that buoyancy would be sufficient to transmit 
injected fluid completely through a breach. 

UBUOYANCY 

Injection fluid is sufficiently buoyant to penetrate upper confining zone 
breach. 

Uniform distribution from 1.0E-05 to 1.0E-04. 

It is assumed that fluid injection would need to be maintained (while los- 
ing pressure to the breach in the confining zones) or even overpressurized 
to provide a sufficient force to drive fluid through breaches in both the 
lower and upper confining zones. For this to occur, there would need to 
be an operator error in failing to detect an injection pressure loss or over- 
pressurization. As explained above, human reliability data show that 
errors of omission for nonpassive tasks occur within a range of 5.0E-04 
to 5.0E-03 per demand. While pressure is checked continuously during 
injection, it is conservatively assumed that a single failure to detect a pres- 
sure change results in significant fluid movement up through the 
breaches. 



Event: RELDETECT 

Description: Groundwater monitoring fails to detect waste release outside injection 
zone. 

Probability: 0.5 

Basis: This probability is based on professional judgment. Given a release of 

waste fluid through postulated confining zone breaches, required ground- 
water monitoring should detect a release. When the release is detected, the 
injection would be ceased, and the driving force for upward fluid move- 
ment would be eliminated. This sequence could fail if the monitoring 
locations are not at or down gradient of the location of the breach in the 
confining zone, or if the time between release and detection is long 
enough that a significant release occurs before corrective action is taken. 

Event: EXTRACT 

Description: Extraction of groundwater from same saturated zone as injection zone. 
Probability: Uniform distribution from 1.0E-05 to 1.0E-03. 

Basis: This probability is based on professional judgment. Deep-well injection 

zones contain nonpotable water, usually of high salinity, with no attractive 
resource value. A number of more useful water-bearing zones occur at 
shallower depths that can be accessed much more cost-effectively. The 
probability of this event occurring near an existing or former deep-injec- 
tion well at any time in the foreseeable future is considered to be very low. 

Event: NORECOGNIZE 

Description: Failure to recognize that groundwater extraction is located within injected 
waste plume. 
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Probability: Uniform distribution from 1.0E-03 to 1.0E-02. 

Basis: Assuming that someone in the future screens an extraction well at injec- 

tion zone depth, there is the probability that they do not recognize the well 
has intercepted an injected waste plume. This event would require both 
the failure to recognize that the well is located within a documented Class 
I hazardous waste injection well AOR and that the extracted water con- 
tains waste. The distribution is based on professional judgment, taking 
into consideration significant uncertainties associated with time frames in 
the thousands of years as well as the small area of the plume relative to 
the entire saturated zone. 



Event: OUTAOR 

Description: Injection waste has migrated outside the AOR to an unconfined zone. 
Probability: Uniform distribution from 1.0E-05 to 1.0E-04. 

Basis: Migration of the injected waste plume outside the AOR is assigned a low 

probability of occurrence given the extensive characterization efforts 
required for the no-migration petition. It is conservatively assumed in the 
PRA that if this event occurs and the injected material is still characteris- 
tically hazardous, then a release to a USDW occurs. Horizontal and 
upward migration of injected fluid far from predicted ranges would be 
necessary for this to occur. 

Event: WASTEPRESENT 

Description: Injected waste has not transformed into non waste. 
Probability: Uniform distribution from 1.0E-02 to 1.0. 

Basis: This event addresses the probability that injected waste has not trans- 

formed into a nonhazardous form at a future time when either (a) ground- 
water is inadvertently extracted from the injected waste plume or (b) the 
plume has migrated outside the AOR to an unconfined zone. The assigned 
probability distribution takes into consideration (a) it is not uncommon 
to render the waste nonhazardous by pretreatment and dilution prior to 
or during injection, (b) injected waste attenuates in the plume, and 
(c) biodegradation and other transformation/loss processes may decrease 
hazardous constituents over time. Inadvertent extraction and migration 
outside the AOR are events with long time frames, and there is reasonable 
likelihood that these factors could have transformed the waste by the time 
of these event sequences. 

Event: PUMPPA 
Description: Annulus pump fails. 

Probability: Triangular distribution with min = 5.0E-05; mode = 3.0E-04; max = 
5.0E-03. 

Basis: The European Industry Reliability Data Bank (Lannoy and Procaccia, 

1996) provides a resource of compiled data for equipment failure rates. 
Based on the failure rates per hour (5.0E-07 to 5.0E-04) for pumps with 
long operating times, the daily (assuming a 10 hour daily operating period) 
probability of pump failure is between 5.0E-06 and 5.0E-03 day -1 . These 
data are generally supported by similar mechanical failure rates from 
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PRAs performed for the nuclear power industry. Range estimates for pump 
failures from a number of nuclear industry resources (McCormick, 1981) 
provide a median value of 3.0E-05 failures/hour (3.0E-04 failures/day). 
For the nuclear industry, redundancies and routine replacement ensure that 
the failure rates and consequences of pump failure are minimal. A triangu- 
lar distribution was used for annulus pump failure rates, using the nuclear 
power industry value of 3.0E-04 failures/day as the mode and assigning 
the European database values as the extreme range values. 

Event: CHECKPA 

Description: Annulus check value fails to open. 

Probability: Triangular distribution with min = 1.0E-04; mode = 3.0E-04; max = 
1.0E-03. 

Basis: Given that the annulus pump fails, CHECKPA is the probability that the 

check valve, designed to keep the annulus fluid contained and pressurized in 
the annulus, stays open. This is an on-demand failure rate in that failure only 
occurs when the component is called to function. Data from McCormick 
(1981) give an on-demand failure rate for check values (fail to open) of 
1.0E-04 to 1.0E-03 per demand (median of 3.0E-04). Because CHECKPA 
is conditional upon PUMPPA, and both are represented by the same AND 
gate within the fault tree, the on-demand probability is used directly. 

Event: CONTROLPA 

Description: Annulus pressure control system fails, resulting in underpressurization. 
Probability: Uniform distribution from 1.0E-06 to 1.0E-04. 

Basis: Control system failures are usually the result of electronic or electrical 

failures resulting from loss of signal function. Lannoy and Procaccia 
(1996) list the range of electrical/electronic failures from the compiled 
databases to be between 5.00E-08 and 1.00E-05 hour -1 . For a one-day 
operating period, this range converts in to a failure probability of 1.2E- 
06-2.4E-04 day -1 . Since this range has no point of central tendency, a 
uniform distribution is selected for the PRA. 



Event: CONTROLPI 

Description: Injection pressure control system resulting in overpressurization. 
Probability: Uniform distribution from 1.0E-06 to 1.0E-04. 

Basis: This is a similar control system failure, as was described for CON- 

TROLPA. Similar logic is used to specify a probability distribution. 

Event: OPERRPA 

Description: Operator error causes annulus pressure to drop below injection pressure. 
Probability: Uniform distribution from 5.0E-05 to 5.0E-04. 

Basis: Swain (1987) provides data on human error, showing a frequency of 1 .0E- 

05 error per action. Assuming the operator is performing five critical 
actions per day that could lead to a potential pressure drop, the daily fail- 
ure rate is 5.0E-05. A uniform distribution that assumes this estimate is 
that lower bound was used; it is equally likely to be up to an order of mag- 
nitude of higher frequency of human error. Since all operator errors in this 
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PRA may be performed by either the same or a similarly trained operator, 
this and the other operator error event probability distributions were corre- 
lated in the Monte Carlo simulation using a correlation coefficient of 0.5. 



Event: OPERRPI 

Description: Operator error causes injection pressure to rise above annulus pressure. 

Probability: Uniform distribution from 5.0E-05 to 5.0E-04. 

Basis: The same basis applies as for event OPERRPA, above. 

Event: OPERRDET 

Description: Operator fails to detect/respond to unacceptable pressure differential. 

Probability: Uniform distribution from 5.0E-05 to 5.0E-04. 

Basis: The same basis applies as for event OPERRPA, above. 

Event: OPERRFRAC 

Description: Operator error results in induced transmissive fracture through lower con- 
fining zone. 

Probability: Uniform distribution from 5.0E-05 to 5.0E-04. 

Basis: The same basis applies as for event OPERRPA, above. 

Event: OPERINJ 

Description: Operator fails to recognize changes in confining zone capacity. 

Probability: Uniform distribution from 5.0E-05 to 5.0E-04. 

Basis: The same basis applies as for event OPERRPA, above. 

Event: CAPLOSS 

Description: Loss of injection zone capacity results in overpressurization. 

Probability: Uniform distribution from 1.0E-05 to 1.0E-03. 

Basis: The capacity of injection zone rock is carefully studied for a Class I well 



as part of the site- selection process and no-migration petition. Given the 
extent of the characterization efforts involved, it is unlikely that a lack of 
capacity will be overlooked. This would be the result of a human error of 
omission, which occurs at a rate of approximately 1.0E-03 per demand. 
Because at least one additional independent review of this factor would be 
performed (e.g., by the regulatory agency), this frequency is assumed to 
be the upper bound of the distribution. 



Event: PERMEA 

Description: Confining zone has unexpected transmissive permeability. 

Probability: Uniform distribution from 1.0E-05 to 1.0E-03. 

Basis: The permeability of confining zone rock is carefully studied for a Class I 



well as part of the site-selection process and no-migration petition. Given 
the extent of the study efforts involved, it is unlikely that permeability will 
be incorrectly characterized. This would be the result of a human error of 
omission, which occurs at a rate of approximately 1.0E-03 per demand. 
Since at least one additional independent review of this factor would be 
performed (e.g., by the regulatory agency), this frequency is assumed to 
be the upper bound of the distribution. 
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Event: DISCONT 

Probability: Uniform distribution from 1.0E-04 to 1.0E-02. 

Description: Presence of unidentified transmissive discontinuity. 

Basis: As per the discussion on the characterization efforts outlined above for 

PERMEA, it is unlikely that the geologic properties of the confining zone 
were not completely described. However, irregularities in the geological 
characteristics of the confining zone are possible, given the lateral extent 
of the injection zone. Thus a factor of 10 higher probability than was 
assigned to PERMEA was used. 



Event: DETECTWELL 

Description: Failure to identify abandoned well in AOR. 
Probability: Uniform distribution from 1.0E-03 to 1.0E-02. 

Basis: Based on similar arguments used for PERMEA and DISCONT, it is 

unlikely that the presence of abandoned wells within the AOR would 
remain undetected. However, records for abandoned wells could be miss- 
ing or incorrect. The distribution range used is higher in error frequency 
to reflect this added consideration. 



Event: ALARM 
Description: Automatic alarm fails. 

Probability: Uniform distribution: 1.00E-05 to 1.00E-03. 

Basis: The frequency of alarm failures were analyzed by Davis and Satterwaite 

(1988) for fire hazards associated with the management and storage of 
radioactive waste. A failure probability of 5.00E-05 was determined. 
However, this assessment was based on alarms with high-reliability 
requirements specified for nuclear facilities. To account for the possibil- 
ity that less-reliable equipment might exist at an injection well facility, 
this value was used as the lower bound of a uniform distribution that 
includes an equal probability that the alarm failure rate could be as much 
as a factor of 100 higher. 



Event: SEISMFAULT 

Description: Seismic event induces a transmissive fault or fracture. 
Probability: Uniform distribution: 1.00E-05 to 1.00E-04. 

Basis: Avoidance of areas prone to seismic activity is carefully studied for a 

Class I well as part of the site- selection process and no-migration petition. 
In addition, seismic factors are part of the design criteria for the well. 
Given the extent of the study efforts involved, it is unlikely that the well 
will be located where seismic activity has been incorrectly characterized. 
The event would more likely be a rare event that heretofore had not 
occurred at such a magnitude in the region of the well site, and therefore 
is not reflected in historical seismic event data. In addition, the seismic 
event would need to result in a transmissive fault or a fracture penetrating 
entirely the confining zone. This event was assigned, by judgment, a prob- 
ability of occurrence in the range of 1 in 100,000 to 1 in 10,000. 
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Event: PLUGFAIL 

Description: Identified abandoned well plug fails. 
Probability: Poisson distribution with 8E-04/well rate. 

Basis: Assignment of failure probability is based on TRC proper plug hearing 

files in Clark (1987). In this study, 2531 oil and gas fields were examined 
for plug leakage incidents in abandoned wells. Two leakage incidents 
were found. The number of abandoned wells could exceed the number of 
fields by a factor of 10. A conservative failure rate was estimated as 2 plug 
failures per 2531 fields, or 8E-04 plug failures per abandoned well 
(assuming only one well per field). Since this event meets the Poisson dis- 
tribution requirements (see above in introductory remarks), a Poisson 
distribution was assumed using the failure rate determined here. 

Event: TRANSUSDW 

Description: Unidentified abandoned well is transmissive through upper confining 

zone to USDW. 
Probability: 0.1 

Basis: There are no data on which to base this event frequency. The assumed 

probability of 0.1 assumed is believed to be very conservative considering 
that the event requires the abandoned well to provide a pathway, other 
than plug failure, to transmit injected waste through the entire confining 
zone. 



Event: TRANSLCZ 

Description: Unidentified abandoned well is transmissive from injection zone through 

lower confining zone. 
Probability: 0.1 

Basis: There are no data on which to base this event frequency. The assumed 

probability of 0. 1 is believed to be very conservative considering that the 
event requires the abandoned well to provide a pathway, other than plug 
failure, to transmit injected waste through the entire confining zone. 

Event: INCOMPWASTE 

Description: Injected waste is incompatible with previously injected material. 
Probability: Uniform distribution from 1.00E-05 to 1.00E-04. 

Basis: Material that is injected is well characterized to ensure that no chemical 

or physical reactions that could sufficiently alter the properties of the 
material in the injected zone take place. In addition, the no-migration peti- 
tion process requires study of waste-host rock compatibility. This event 
also assumes sufficient waste volume and reaction with the confining- 
zone rock to result in a complete breach of the confining zone. This event 
was assigned, conservatively by judgment, a probability of occurrence in 
the range of 1 in 100,000 to 1 in 10,000. 



